{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:39:42Z","timestamp":1791459582570,"version":"4.3.4"},"reference-count":22,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2015,12,2]],"date-time":"2015-12-02T00:00:00Z","timestamp":1449014400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"DARPA's Computer Science Study Group"},{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2015,12,2]]},"abstract":"<jats:p>Integer overflow bugs in C and C++ programs are difficult to track down and may lead to fatal errors or exploitable vulnerabilities. Although a number of tools for finding these bugs exist, the situation is complicated because not all overflows are bugs. Better tools need to be constructed, but a thorough understanding of the issues behind these errors does not yet exist. We developed IOC, a dynamic checking tool for integer overflows, and used it to conduct the first detailed empirical study of the prevalence and patterns of occurrence of integer overflows in C and C++ code. Our results show that intentional uses of wraparound behaviors are more common than is widely believed; for example, there are over 200 distinct locations in the SPEC CINT2000 benchmarks where overflow occurs. Although many overflows are intentional, a large number of accidental overflows also occur. Orthogonal to programmers' intent, overflows are found in both well-defined and undefined flavors. Applications executing undefined operations can be, and have been, broken by improvements in compiler optimizations. Looking beyond SPEC, we found and reported undefined integer overflows in SQLite, PostgreSQL, SafeInt, GNU MPC and GMP, Firefox, LLVM, Python, BIND, and OpenSSL; many of these have since been fixed.<\/jats:p>","DOI":"10.1145\/2743019","type":"journal-article","created":{"date-parts":[[2015,12,4]],"date-time":"2015-12-04T08:43:07Z","timestamp":1449218587000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":54,"title":["Understanding Integer Overflow in C\/C++"],"prefix":"10.1145","volume":"25","author":[{"given":"Will","family":"Dietz","sequence":"first","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peng","family":"Li","sequence":"additional","affiliation":[{"name":"University of Utah"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"John","family":"Regehr","sequence":"additional","affiliation":[{"name":"University of Utah"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vikram","family":"Adve","sequence":"additional","affiliation":[{"name":"University of Illinois at Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2015,12,2]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the Symposium on Network and Distributed Systems Security (NDSS).","author":"Brumley D.","unstructured":"D. Brumley , T. Chiueh , R. Johnson , H. Lin , and D. Song . 2007. RICH: Automatically protecting against integer-based vulnerabilities . In Proceedings of the Symposium on Network and Distributed Systems Security (NDSS). D. Brumley, T. Chiueh, R. Johnson, H. Lin, and D. Song. 2007. RICH: Automatically protecting against integer-based vulnerabilities. In Proceedings of the Symposium on Network and Distributed Systems Security (NDSS)."},{"key":"e_1_2_1_2_1","unstructured":"CERT. 2006. IntegerLib a Secure Integer Library. (2006). http:\/\/www.cert.org\/secure-coding\/IntegerLib.zip.  CERT. 2006. IntegerLib a Secure Integer Library. (2006). http:\/\/www.cert.org\/secure-coding\/IntegerLib.zip."},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 4th International Conference on Availability, Reliability and Security. 208--215","author":"Chen P.","unstructured":"P. Chen , Y. Wang , Z. Xin , B. Mao , and L. Xie . 2009. BRICK: A binary tool for run-time detecting and locating integer-based vulnerability . In Proceedings of the 4th International Conference on Availability, Reliability and Security. 208--215 . P. Chen, Y. Wang, Z. Xin, B. Mao, and L. Xie. 2009. BRICK: A binary tool for run-time detecting and locating integer-based vulnerability. In Proceedings of the 4th International Conference on Availability, Reliability and Security. 208--215."},{"key":"e_1_2_1_4_1","unstructured":"S. Christey and R. A. Martin. 2007. Vulnerability type distributions in CVE. Tech. report. MITRE Corporation. May. http:\/\/cwe.mitre.org\/documents\/vuln-trends.html.  S. Christey and R. A. Martin. 2007. Vulnerability type distributions in CVE. Tech. report. MITRE Corporation. May. http:\/\/cwe.mitre.org\/documents\/vuln-trends.html."},{"key":"e_1_2_1_5_1","unstructured":"S. Christey R. A. Martin M. Brown A. Paller and D. Kirby. 2011. 2011 CWE\/SANS top 25 most dangerous software errors. Tech. report. MITRE Corporation. September. http:\/\/cwe.mitre.org.top25.  S. Christey R. A. Martin M. Brown A. Paller and D. Kirby. 2011. 2011 CWE\/SANS top 25 most dangerous software errors. Tech. report. MITRE Corporation. September. http:\/\/cwe.mitre.org.top25."},{"key":"e_1_2_1_6_1","volume-title":"Clang: A C language family frontend for LLVM","year":"2011","unstructured":"Clang. 2011 . Clang: A C language family frontend for LLVM . http:\/\/clang.llvm.org. (Last accessed Sept. 2011). Clang. 2011. Clang: A C language family frontend for LLVM. http:\/\/clang.llvm.org. (Last accessed Sept. 2011)."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2010.29"},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of the International Conference on Software Engineering (ICSE'12)","author":"Dietz W.","unstructured":"W. Dietz , P. Li , J. Regehr , and V. Adve . 2012. Understanding integer overflow in C\/C++ . In Proceedings of the International Conference on Software Engineering (ICSE'12) . IEEE Press, 760--770. W. Dietz, P. Li, J. Regehr, and V. Adve. 2012. Understanding integer overflow in C\/C++. In Proceedings of the International Conference on Software Engineering (ICSE'12). IEEE Press, 760--770."},{"key":"e_1_2_1_9_1","volume-title":"Why do Pinky and Inky have different behaviors when Pac-Man is facing up? (Dec","author":"Hodges D.","year":"2008","unstructured":"D. Hodges . 2008. Why do Pinky and Inky have different behaviors when Pac-Man is facing up? (Dec . 2008 ). http:\/\/donhodges.com\/pacman_pinky_explanation.htm. ( Last accessed Sept. 2011). D. Hodges. 2008. Why do Pinky and Inky have different behaviors when Pac-Man is facing up? (Dec. 2008). http:\/\/donhodges.com\/pacman_pinky_explanation.htm. (Last accessed Sept. 2011)."},{"key":"e_1_2_1_10_1","volume-title":"Intel VTune amplifier XE","year":"2013","unstructured":"Intel. 2013. Intel VTune amplifier XE 2013 . (2013). http:\/\/software.intel.com\/en-us\/intel-vtune-amplifier-xe Intel. 2013. Intel VTune amplifier XE 2013. (2013). http:\/\/software.intel.com\/en-us\/intel-vtune-amplifier-xe"},{"key":"e_1_2_1_11_1","volume-title":"Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04)","author":"Lattner C.","unstructured":"C. Lattner and V. Adve . 2004. LLVM: A compilation framework for lifelong program analysis & transformation . In Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04) . C. Lattner and V. Adve. 2004. LLVM: A compilation framework for lifelong program analysis & transformation. In Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04)."},{"key":"e_1_2_1_12_1","unstructured":"D. LeBlanc. 2004. Integer handling with the C++ SafeInt class. http:\/\/msdn.microsoft.com\/library\/default.asp?url&equals;\/library\/en-us\/dncode\/html\/secure01142004.asp.  D. LeBlanc. 2004. Integer handling with the C++ SafeInt class. http:\/\/msdn.microsoft.com\/library\/default.asp?url&equals;\/library\/en-us\/dncode\/html\/secure01142004.asp."},{"key":"e_1_2_1_13_1","unstructured":"D. LeBlanc. 2011. Author's blog: Integer handling with the C++ SafeInt class. http:\/\/safeint.codeplex.com\/.  D. LeBlanc. 2011. Author's blog: Integer handling with the C++ SafeInt class. http:\/\/safeint.codeplex.com\/."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.1993.274940"},{"key":"e_1_2_1_15_1","unstructured":"MITRE Corporation. 2002. CVE-2002-0639: Integer overflow in sshd in OpenSSH. http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name&equals;CVE-2002-0639.  MITRE Corporation. 2002. CVE-2002-0639: Integer overflow in sshd in OpenSSH. http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name&equals;CVE-2002-0639."},{"key":"e_1_2_1_16_1","unstructured":"MITRE Corporation. 2010. CVE-2010-2753: Integer overflow in Mozilla Firefox Thunderbird and SeaMonkey. http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name&equals;CVE-2010-2753.  MITRE Corporation. 2010. CVE-2010-2753: Integer overflow in Mozilla Firefox Thunderbird and SeaMonkey. http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name&equals;CVE-2010-2753."},{"key":"e_1_2_1_17_1","unstructured":"MITRE Corporation. 2013. Common vulnerability and exposures. http:\/\/cve.mitre.org\/.  MITRE Corporation. 2013. Common vulnerability and exposures. http:\/\/cve.mitre.org\/."},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the 18th USENIX Security Symposium. 67--82","author":"Molnar D.","unstructured":"D. Molnar , X. C. Li , and D. A. Wagner . 2009. Dynamic test generation to find integer bugs in x86 binary Linux programs . In Proceedings of the 18th USENIX Security Symposium. 67--82 . D. Molnar, X. C. Li, and D. A. Wagner. 2009. Dynamic test generation to find integer bugs in x86 binary Linux programs. In Proceedings of the 18th USENIX Security Symposium. 67--82."},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of the 3rd Workshop on Runtime Verification.","author":"Nethercote N.","unstructured":"N. Nethercote and J. Seward . 2003. Valgrind: A program supervision framework . In Proceedings of the 3rd Workshop on Runtime Verification. N. Nethercote and J. Seward. 2003. Valgrind: A program supervision framework. In Proceedings of the 3rd Workshop on Runtime Verification."},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the 16th Network and Distributed System Security Symp.","author":"Wang T.","unstructured":"T. Wang , T. Wei , Z. Lin , and W. Zou . 2009. IntScope: Automatically detecting integer overflow vulnerability in X86 binary using symbolic execution . In Proceedings of the 16th Network and Distributed System Security Symp. T. Wang, T. Wei, Z. Lin, and W. Zou. 2009. IntScope: Automatically detecting integer overflow vulnerability in X86 binary using symbolic execution. In Proceedings of the 16th Network and Distributed System Security Symp."},{"key":"e_1_2_1_21_1","unstructured":"Wikipedia. 2011a. Arbitrary-precision arithmetic. http:\/\/en.wikipedia.org\/wiki\/Arbitrary-precision_arithmetic. (Last accessed Sept. 2011).  Wikipedia. 2011a. Arbitrary-precision arithmetic. http:\/\/en.wikipedia.org\/wiki\/Arbitrary-precision_arithmetic. (Last accessed Sept. 2011)."},{"key":"e_1_2_1_22_1","volume-title":"http:\/\/en.wikipedia.org\/w\/index.php?title&equals;Pac-Man&oldid&equals;&equals;450692749#Split-screen. (Last accessed","year":"2011","unstructured":"Wikipedia. 2011b. Pac-Man. http:\/\/en.wikipedia.org\/w\/index.php?title&equals;Pac-Man&oldid&equals;&equals;450692749#Split-screen. (Last accessed Sept. 2011 ). Wikipedia. 2011b. Pac-Man. http:\/\/en.wikipedia.org\/w\/index.php?title&equals;Pac-Man&oldid&equals;&equals;450692749#Split-screen. (Last accessed Sept. 2011)."}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2743019","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2743019","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:16:34Z","timestamp":1750212994000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2743019"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,12,2]]},"references-count":22,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2015,12,2]]}},"alternative-id":["10.1145\/2743019"],"URL":"https:\/\/doi.org\/10.1145\/2743019","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,12,2]]},"assertion":[{"value":"2015-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2015-03-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2015-12-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}